@open-mercato/core 0.4.2-canary-da2b080494 → 0.4.2-canary-19353c5970

package/src/modules/dashboards/components/WidgetVisibilityEditor.tsx

@@ -44,9 +44,13 @@ type UserProps = BaseProps & {
 
 type WidgetVisibilityEditorProps = RoleProps | UserProps
 
+export type WidgetVisibilityEditorHandle = {
+  save: () => Promise<void>
+}
+
 const EMPTY: string[] = []
 
-export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
+export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHandle, WidgetVisibilityEditorProps>(function WidgetVisibilityEditor(props, ref) {
   const t = useT()
   const { kind, targetId, tenantId, organizationId } = props
   const [catalog, setCatalog] = React.useState<WidgetCatalogItem[]>([])
@@ -60,6 +64,15 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
   const [originalMode, setOriginalMode] = React.useState<'inherit' | 'override'>('inherit')
   const [effective, setEffective] = React.useState<string[]>(EMPTY)
 
+  const dirty = React.useMemo(() => {
+    if (kind === 'user') {
+      if (mode !== originalMode) return true
+      if (mode === 'override') return selected.join('|') !== original.join('|')
+      return false
+    }
+    return selected.join('|') !== original.join('|')
+  }, [kind, mode, original, originalMode, selected])
+
   const loadCatalog = React.useCallback(async () => {
     const data = await readApiResultOrThrow<{ items?: unknown[] }>(
       '/api/dashboards/widgets/catalog',
@@ -149,6 +162,9 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
   }, [original, originalMode])
 
   const save = React.useCallback(async () => {
+    if (loading) return
+    if (error && catalog.length === 0) return
+    if (!dirty) return
     setSaving(true)
     setError(null)
     try {
@@ -202,16 +218,9 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
     } finally {
       setSaving(false)
     }
-  }, [kind, mode, organizationId, selected, t, targetId, tenantId])
+  }, [catalog.length, dirty, error, kind, loading, mode, organizationId, selected, t, targetId, tenantId])
 
-  const dirty = React.useMemo(() => {
-    if (kind === 'user') {
-      if (mode !== originalMode) return true
-      if (mode === 'override') return selected.join('|') !== original.join('|')
-      return false
-    }
-    return selected.join('|') !== original.join('|')
-  }, [kind, mode, original, originalMode, selected])
+  React.useImperativeHandle(ref, () => ({ save }), [save])
 
   if (loading) {
     return (
@@ -297,4 +306,6 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
       </div>
     </div>
   )
-}
+})
+
+WidgetVisibilityEditor.displayName = 'WidgetVisibilityEditor'

package/src/modules/dashboards/lib/role-widgets.ts

@@ -0,0 +1,80 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { Role } from '@open-mercato/core/modules/auth/data/entities'
+import { DashboardRoleWidgets } from '../data/entities'
+import { loadAllWidgets } from './widgets'
+
+type RoleWidgetScope = {
+  tenantId: string
+  organizationId?: string | null
+  roleNames: string[]
+  widgetIds: string[]
+}
+
+async function findRoleByName(
+  em: EntityManager,
+  roleName: string,
+  tenantId: string,
+): Promise<Role | null> {
+  const tenantRole = await em.findOne(Role, { name: roleName, tenantId })
+  if (tenantRole) return tenantRole
+  return em.findOne(Role, { name: roleName, tenantId: null })
+}
+
+export async function resolveAnalyticsWidgetIds(): Promise<string[]> {
+  const widgets = await loadAllWidgets()
+  return widgets
+    .filter((widget) => widget.metadata.category === 'analytics' || widget.metadata.id.startsWith('dashboards.analytics.'))
+    .map((widget) => widget.metadata.id)
+}
+
+export async function appendWidgetsToRoles(
+  em: EntityManager,
+  { tenantId, organizationId = null, roleNames, widgetIds }: RoleWidgetScope,
+): Promise<boolean> {
+  const trimmedTenantId = tenantId.trim()
+  const widgets = await loadAllWidgets()
+  const validWidgetIds = new Set(widgets.map((widget) => widget.metadata.id))
+  const resolvedWidgetIds = widgetIds.filter((id) => validWidgetIds.has(id))
+  if (!resolvedWidgetIds.length) return false
+
+  let updated = false
+  await em.transactional(async (tem) => {
+    for (const roleName of roleNames) {
+      const role = await findRoleByName(tem, roleName, trimmedTenantId)
+      if (!role) continue
+
+      const record = await tem.findOne(DashboardRoleWidgets, {
+        roleId: String(role.id),
+        tenantId: trimmedTenantId,
+        organizationId,
+        deletedAt: null,
+      })
+      const roleRecord = record ?? (organizationId
+        ? await tem.findOne(DashboardRoleWidgets, {
+          roleId: String(role.id),
+          tenantId: trimmedTenantId,
+          organizationId: null,
+          deletedAt: null,
+        })
+        : null)
+      if (!roleRecord) continue
+
+      const current = Array.isArray(roleRecord.widgetIdsJson) ? roleRecord.widgetIdsJson : []
+      const next = [...current]
+      const existing = new Set(current)
+      for (const widgetId of resolvedWidgetIds) {
+        if (existing.has(widgetId)) continue
+        existing.add(widgetId)
+        next.push(widgetId)
+      }
+
+      if (next.length === current.length) continue
+      roleRecord.widgetIdsJson = next
+      roleRecord.updatedAt = new Date()
+      tem.persist(roleRecord)
+      updated = true
+    }
+  })
+
+  return updated
+}

package/src/modules/dashboards/services/widgetDataService.ts

@@ -1,6 +1,10 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
 import { createHash } from 'node:crypto'
+import { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
+import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
+import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
   type DateRangePreset,
   resolveDateRange,
@@ -17,6 +21,8 @@ import {
 import type { AnalyticsRegistry } from './analyticsRegistry'
 
 const WIDGET_DATA_CACHE_TTL = 120_000
+const WIDGET_DATA_SEGMENT_TTL = 86_400_000
+const WIDGET_DATA_SEGMENT_KEY = 'widget-data:__segment__'
 
 const SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/
 
@@ -168,6 +174,11 @@ export class WidgetDataService {
       const tags = this.getCacheTags(request.entityType)
       try {
         await this.cache.set(cacheKey, response, { ttl: WIDGET_DATA_CACHE_TTL, tags })
+        await this.cache.set(
+          WIDGET_DATA_SEGMENT_KEY,
+          { updatedAt: response.metadata.fetchedAt },
+          { ttl: WIDGET_DATA_SEGMENT_TTL, tags: ['widget-data'] },
+        )
       } catch {
       }
     }
@@ -282,6 +293,75 @@ export class WidgetDataService {
     assertSafeIdentifier(config.idColumn, 'id column')
     assertSafeIdentifier(config.labelColumn, 'label column')
 
+    const meta = this.resolveEntityMetadata(config.table)
+    const idProp = meta ? this.resolveEntityPropertyName(meta, config.idColumn) : null
+    const labelProp = meta ? this.resolveEntityPropertyName(meta, config.labelColumn) : null
+    const tenantProp = meta
+      ? (this.resolveEntityPropertyName(meta, 'tenant_id') ?? this.resolveEntityPropertyName(meta, 'tenantId'))
+      : null
+    const organizationProp = meta
+      ? (this.resolveEntityPropertyName(meta, 'organization_id') ?? this.resolveEntityPropertyName(meta, 'organizationId'))
+      : null
+    const entityName = meta ? ((meta as any).class ?? meta.className ?? meta.name) : null
+
+    if (meta && idProp && labelProp && tenantProp && entityName) {
+      const where: Record<string, unknown> = {
+        [idProp]: { $in: uniqueIds },
+        [tenantProp]: this.scope.tenantId,
+      }
+      if (organizationProp && this.scope.organizationIds && this.scope.organizationIds.length > 0) {
+        where[organizationProp] = { $in: this.scope.organizationIds }
+      }
+
+      try {
+        const records = await findWithDecryption(
+          this.em,
+          entityName,
+          where,
+          { fields: [idProp, labelProp, tenantProp, organizationProp].filter(Boolean) },
+          { tenantId: this.scope.tenantId, organizationId: this.resolveOrganizationId() },
+        )
+
+        const encryptionService = resolveTenantEncryptionService(this.em as any)
+        const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null
+        let hasEncryptedLabels = false
+        let hasDecryptedLabels = false
+
+        const labelMap = new Map<string, string>()
+        for (const record of records as Array<Record<string, unknown>>) {
+          const id = record[idProp]
+          let labelValue = record[labelProp]
+          if (typeof labelValue === 'string' && this.isEncryptedPayload(labelValue)) {
+            hasEncryptedLabels = true
+            if (dek?.key) {
+              const decrypted = this.decryptWithDek(labelValue, dek.key)
+              if (decrypted !== null) {
+                labelValue = decrypted
+                hasDecryptedLabels = true
+              }
+            }
+          } else if (labelValue != null && labelValue !== '') {
+            hasDecryptedLabels = true
+          }
+
+          if (typeof id === 'string' && labelValue != null && labelValue !== '') {
+            labelMap.set(id, String(labelValue))
+          }
+        }
+
+        if (labelMap.size > 0 && (!hasEncryptedLabels || hasDecryptedLabels)) {
+          return data.map((item) => ({
+            ...item,
+            groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)
+              ? labelMap.get(item.groupKey)!
+              : undefined,
+          }))
+        }
+      } catch {
+        // fall through to SQL resolution
+      }
+    }
+
     const clauses = [`"${config.idColumn}" = ANY(?::uuid[])`, 'tenant_id = ?']
     const params: unknown[] = [`{${uniqueIds.join(',')}}`, this.scope.tenantId]
 
@@ -290,17 +370,43 @@ export class WidgetDataService {
       params.push(`{${this.scope.organizationIds.join(',')}}`)
     }
 
-    const sql = `SELECT "${config.idColumn}" as id, "${config.labelColumn}" as label FROM "${config.table}" WHERE ${clauses.join(
+    const sql = `SELECT "${config.idColumn}" as id, "${config.labelColumn}" as label, tenant_id, organization_id FROM "${config.table}" WHERE ${clauses.join(
       ' AND ',
     )}`
 
     try {
       const labelRows = await this.em.getConnection().execute(sql, params)
+      const entityId = this.resolveEntityId(meta)
+      const encryptionService = resolveTenantEncryptionService(this.em as any)
+      const organizationId = this.resolveOrganizationId()
+      const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null
 
       const labelMap = new Map<string, string>()
-      for (const row of labelRows as Array<{ id: string; label: string | null }>) {
-        if (row.id && row.label != null && row.label !== '') {
-          labelMap.set(row.id, row.label)
+      for (const row of labelRows as Array<{ id: string; label: string | null; tenant_id?: string | null; organization_id?: string | null }>) {
+        let labelValue = row.label
+        if (entityId && encryptionService?.isEnabled() && labelValue != null) {
+          const rowOrgId = row.organization_id ?? organizationId ?? null
+          const decrypted = await encryptionService.decryptEntityPayload(
+            entityId,
+            { [config.labelColumn]: labelValue },
+            this.scope.tenantId,
+            rowOrgId,
+          )
+          const resolved = decrypted[config.labelColumn]
+          if (typeof resolved === 'string' || typeof resolved === 'number') {
+            labelValue = String(resolved)
+          }
+        }
+
+        if (labelValue && dek?.key && this.isEncryptedPayload(labelValue)) {
+          const decrypted = this.decryptWithDek(labelValue, dek.key)
+          if (decrypted !== null) {
+            labelValue = decrypted
+          }
+        }
+
+        if (row.id && labelValue != null && labelValue !== '') {
+          labelMap.set(row.id, labelValue)
         }
       }
 
@@ -317,6 +423,60 @@ export class WidgetDataService {
       }))
     }
   }
+
+  private resolveOrganizationId(): string | null {
+    if (!this.scope.organizationIds || this.scope.organizationIds.length !== 1) return null
+    return this.scope.organizationIds[0] ?? null
+  }
+
+  private resolveEntityMetadata(tableName: string): Record<string, any> | null {
+    const registry = (this.em as any)?.getMetadata?.()
+    if (!registry) return null
+    const entries =
+      (typeof registry.getAll === 'function' && registry.getAll()) ||
+      (Array.isArray(registry.metadata) ? registry.metadata : Object.values(registry.metadata ?? {}))
+    const metas = Array.isArray(entries) ? entries : Object.values(entries ?? {})
+    const match = metas.find((meta: any) => {
+      const table = meta?.tableName ?? meta?.collection
+      if (typeof table !== 'string') return false
+      if (table === tableName) return true
+      return table.split('.').pop() === tableName
+    })
+    return match ?? null
+  }
+
+  private resolveEntityPropertyName(meta: Record<string, any>, columnName: string): string | null {
+    const properties = meta?.properties ? Object.values(meta.properties) : []
+    for (const prop of properties as Array<Record<string, any>>) {
+      const fieldName = prop?.fieldName
+      const fieldNames = prop?.fieldNames
+      if (typeof fieldName === 'string' && fieldName === columnName) return prop?.name ?? null
+      if (Array.isArray(fieldNames) && fieldNames.includes(columnName)) return prop?.name ?? null
+      if (prop?.name === columnName) return prop?.name ?? null
+    }
+    return null
+  }
+
+  private resolveEntityId(meta: Record<string, any> | null): string | null {
+    if (!meta) return null
+    try {
+      return resolveEntityIdFromMetadata(meta as any)
+    } catch {
+      return null
+    }
+  }
+
+  private isEncryptedPayload(value: string): boolean {
+    const parts = value.split(':')
+    return parts.length === 4 && parts[3] === 'v1'
+  }
+
+  private decryptWithDek(value: string, dek: string): string | null {
+    const first = decryptWithAesGcm(value, dek)
+    if (first === null) return null
+    if (!this.isEncryptedPayload(first)) return first
+    return decryptWithAesGcm(first, dek) ?? first
+  }
 }
 
 export function createWidgetDataService(

package/src/modules/dictionaries/components/DictionaryTable.tsx

@@ -171,12 +171,14 @@ export function DictionaryTable({
               const items: RowActionItem[] = []
               if (onEdit) {
                 items.push({
+                  id: 'edit',
                   label: translations.editLabel,
                   onSelect: () => onEdit(entry),
                 })
               }
               if (onDelete) {
                 items.push({
+                  id: 'delete',
                   label: translations.deleteLabel,
                   onSelect: () => onDelete(entry),
                   destructive: true,

package/src/modules/directory/backend/directory/organizations/page.tsx

@@ -235,8 +235,8 @@ export default function DirectoryOrganizationsPage() {
             canManage ? (
               <RowActions
                 items={[
-                  { label: t('directory.organizations.list.actions.edit', 'Edit'), href: `/backend/directory/organizations/${row.id}/edit` },
-                  { label: t('directory.organizations.list.actions.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
+                  { id: 'edit', label: t('directory.organizations.list.actions.edit', 'Edit'), href: `/backend/directory/organizations/${row.id}/edit` },
+                  { id: 'delete', label: t('directory.organizations.list.actions.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
                 ]}
               />
             ) : null

package/src/modules/directory/backend/directory/tenants/page.tsx

@@ -160,8 +160,8 @@ export default function DirectoryTenantsPage() {
             canManage ? (
               <RowActions
                 items={[
-                  { label: t('common.edit', 'Edit'), href: `/backend/directory/tenants/${row.id}/edit` },
-                  { label: t('common.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
+                  { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/directory/tenants/${row.id}/edit` },
+                  { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },
                 ]}
               />
             ) : null

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -338,8 +338,8 @@ export RECORD_ID="<record uuid>"`}</code></pre>
           rowActions={(row) => (
             <RowActions
               items={[
-                { label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
-                { label: 'Delete', destructive: true, onSelect: async () => {
+                { id: 'edit', label: 'Edit', href: `/backend/entities/user/${encodeURIComponent(entityId)}/records/${encodeURIComponent(String((row as any).id))}` },
+                { id: 'delete', label: 'Delete', destructive: true, onSelect: async () => {
                   try {
                     if (typeof window !== 'undefined') {
                       const ok = window.confirm('Delete this record?')

package/src/modules/entities/components/SystemEntitiesTable.tsx

@@ -88,7 +88,7 @@ export default function SystemEntitiesTable() {
       rowActions={(row) => (
         <RowActions
           items={[
-            { label: 'Edit', href: `/backend/entities/system/${encodeURIComponent(row.entityId)}` },
+            { id: 'edit', label: 'Edit', href: `/backend/entities/system/${encodeURIComponent(row.entityId)}` },
           ]}
         />
       )}

package/src/modules/entities/components/UserEntitiesTable.tsx

@@ -110,8 +110,8 @@ export default function UserEntitiesTable() {
       rowActions={(row) => (
         <RowActions
           items={[
-            { label: t('common.edit', 'Edit'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}` },
-            { label: t('entities.user.table.actions.showRecords', 'Show records'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}/records` },
+            { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}` },
+            { id: 'show-records', label: t('entities.user.table.actions.showRecords', 'Show records'), href: `/backend/entities/user/${encodeURIComponent(row.entityId)}/records` },
           ]}
         />
       )}

package/src/modules/feature_toggles/components/FeatureTogglesTable.tsx

@@ -205,12 +205,11 @@ export function FeatureTogglesTable() {
       }}
       rowActions={(row) => (
         <RowActions items={[
-          { label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.id}/edit` },
-          { label: t('common.view', 'Overrides'), href: `/backend/feature-toggles/global/${row.id}` },
-          { label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
+          { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.id}/edit` },
+          { id: 'view', label: t('common.view', 'Overrides'), href: `/backend/feature-toggles/global/${row.id}` },
+          { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
         ]} />
       )}
     />
   )
 }
-

package/src/modules/feature_toggles/components/OverridesTable.tsx

@@ -161,7 +161,7 @@ export default function OverridesTable() {
             }}
             rowActions={(row) => (
                 <RowActions items={[
-                    { label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.toggleId}` },
+                    { id: 'edit', label: t('common.edit', 'Edit'), href: `/backend/feature-toggles/global/${row.toggleId}` },
                 ]} />
             )}
             error={error ? error.message : undefined}

package/src/modules/notifications/__tests__/deliver-notification.test.ts

@@ -0,0 +1,195 @@
+import type { Notification } from '../data/entities'
+import type { NotificationDeliveryConfig } from '../lib/deliveryConfig'
+import type { NotificationDeliveryStrategy } from '../lib/deliveryStrategies'
+
+const sendEmail = jest.fn()
+const getNotificationDeliveryStrategies = jest.fn()
+const resolveNotificationDeliveryConfig = jest.fn()
+const resolveNotificationPanelUrl = jest.fn()
+const findOneWithDecryption = jest.fn()
+const NotificationEmail = jest.fn(() => 'notification-email')
+
+jest.mock('@open-mercato/shared/lib/email/send', () => ({
+  sendEmail: (...args: unknown[]) => sendEmail(...args),
+}))
+
+jest.mock('../lib/deliveryStrategies', () => ({
+  getNotificationDeliveryStrategies: (...args: unknown[]) => getNotificationDeliveryStrategies(...args),
+}))
+
+jest.mock('../lib/deliveryConfig', () => ({
+  DEFAULT_NOTIFICATION_DELIVERY_CONFIG: {
+    panelPath: '/backend/notifications',
+    strategies: {
+      database: { enabled: true },
+      email: { enabled: true },
+      custom: {},
+    },
+  },
+  resolveNotificationDeliveryConfig: (...args: unknown[]) => resolveNotificationDeliveryConfig(...args),
+  resolveNotificationPanelUrl: (...args: unknown[]) => resolveNotificationPanelUrl(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  loadDictionary: jest.fn().mockResolvedValue({}),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/translate', () => ({
+  createFallbackTranslator: () => (key: string, fallback?: string) => fallback ?? key,
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: (...args: unknown[]) => findOneWithDecryption(...args),
+}))
+
+jest.mock('../emails/NotificationEmail', () => ({
+  __esModule: true,
+  default: (...args: unknown[]) => NotificationEmail(...args),
+}))
+
+describe('deliver notification subscriber', () => {
+  const notification: Notification = {
+    id: '32e22a6e-7aa9-4f3b-8a7b-42c2d1223a5f',
+    recipientUserId: '3eae68bb-1e4c-4b21-85c7-b8f5b2c22b01',
+    tenantId: 'c33b6f78-8c4b-4ef4-9c54-2b64b5f5d0d0',
+    organizationId: null,
+    type: 'system',
+    title: 'New notification',
+    body: 'Check details',
+    titleKey: null,
+    bodyKey: null,
+    titleVariables: null,
+    bodyVariables: null,
+    icon: null,
+    severity: 'info',
+    actionData: {
+      actions: [{ id: 'action-1', label: 'Review' }],
+      primaryActionId: 'action-1',
+    },
+    sourceModule: null,
+    sourceEntityType: null,
+    sourceEntityId: null,
+    linkHref: null,
+    groupKey: null,
+    status: 'unread',
+    readAt: null,
+    actionedAt: null,
+    dismissedAt: null,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    expiresAt: null,
+    actionTaken: null,
+    actionResult: null,
+  } as Notification
+
+  const baseConfig: NotificationDeliveryConfig = {
+    appUrl: 'https://app.example.com',
+    panelPath: '/backend/notifications',
+    strategies: {
+      database: { enabled: true },
+      email: {
+        enabled: true,
+        from: 'notifications@example.com',
+        replyTo: 'reply@example.com',
+        subjectPrefix: '[OM]',
+      },
+      custom: {},
+    },
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('sends email notifications when enabled', async () => {
+    resolveNotificationDeliveryConfig.mockResolvedValue(baseConfig)
+    resolveNotificationPanelUrl.mockReturnValue('https://app.example.com/backend/notifications')
+    getNotificationDeliveryStrategies.mockReturnValue([])
+    findOneWithDecryption.mockResolvedValue({ email: 'user@example.com', name: 'User' })
+
+    const em = {
+      findOne: jest.fn().mockResolvedValue(notification),
+    }
+
+    const { default: handle } = await import('../subscribers/deliver-notification')
+
+    await handle(
+      {
+        notificationId: notification.id,
+        recipientUserId: notification.recipientUserId,
+        tenantId: notification.tenantId,
+        organizationId: null,
+      },
+      {
+        resolve: (name: string) => {
+          if (name === 'em') return em
+          throw new Error(`Missing dependency: ${name}`)
+        },
+      }
+    )
+
+    expect(NotificationEmail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        title: notification.title,
+        panelUrl: `https://app.example.com/backend/notifications?notificationId=${notification.id}`,
+      })
+    )
+    expect(sendEmail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: 'user@example.com',
+        from: baseConfig.strategies.email.from,
+        replyTo: baseConfig.strategies.email.replyTo,
+        subject: `${baseConfig.strategies.email.subjectPrefix} ${notification.title}`,
+      })
+    )
+  })
+
+  it('executes enabled custom delivery strategies', async () => {
+    const customStrategy: NotificationDeliveryStrategy = {
+      id: 'webhook',
+      deliver: jest.fn(),
+    }
+    resolveNotificationDeliveryConfig.mockResolvedValue({
+      ...baseConfig,
+      strategies: {
+        ...baseConfig.strategies,
+        email: { enabled: false },
+        custom: {
+          webhook: { enabled: true, config: { url: 'https://hooks.example.com' } },
+        },
+      },
+    })
+    resolveNotificationPanelUrl.mockReturnValue('/backend/notifications')
+    getNotificationDeliveryStrategies.mockReturnValue([customStrategy])
+    findOneWithDecryption.mockResolvedValue({ email: 'user@example.com', name: 'User' })
+
+    const em = {
+      findOne: jest.fn().mockResolvedValue(notification),
+    }
+
+    const { default: handle } = await import('../subscribers/deliver-notification')
+
+    await handle(
+      {
+        notificationId: notification.id,
+        recipientUserId: notification.recipientUserId,
+        tenantId: notification.tenantId,
+        organizationId: null,
+      },
+      {
+        resolve: (name: string) => {
+          if (name === 'em') return em
+          throw new Error(`Missing dependency: ${name}`)
+        },
+      }
+    )
+
+    expect(customStrategy.deliver).toHaveBeenCalledWith(
+      expect.objectContaining({
+        config: { enabled: true, config: { url: 'https://hooks.example.com' } },
+        panelLink: `/backend/notifications?notificationId=${notification.id}`,
+      })
+    )
+    expect(sendEmail).not.toHaveBeenCalled()
+  })
+})